Privacy Map

Asia. National jurisdiction.

Japan JP

EU adequacy decisionPrimary authority: Personal Information Protection Commission (PPC)
Part I

Domestic law

Comprehensive data protection2

  • APPIAct on the Protection of Personal Information (Act No. 57 of 2003)In force
    In force from     Japan's general privacy law covering private businesses and, since 2022–23, public bodies. It regulates purpose specification, third-party provision (with opt-out and records), security, breach reporting, retained-data requests and overseas transfers.
    Synopsis

    Japan's general privacy law covering private businesses and, since 2022–23, public bodies. It regulates purpose specification, third-party provision (with opt-out and records), security, breach reporting, retained-data requests and overseas transfers.

    Key themes
    • purpose of use
    • third-party provision
    • pseudonymously processed information
    • anonymised information
    • breach reporting
    • overseas transfers
    • extraterritoriality
    Unique features

    Pseudonymously processed information category allows internal analytics with relaxed purpose rules; overseas transfers need informed consent unless recipient country is whitelisted (EU/UK) or recipient has equivalent systems.

    SaaS relevance

    Applies to foreign businesses handling personal information of people in Japan in connection with supplying goods or services to them; SaaS processors receiving data under 'entrustment' must be supervised by the client.

    Extraterritorial
    Yes
    Breach notification
    PPC and individuals for prescribed breaches (sensitive data, financial-harm risk, malicious purpose, >1,000 people): preliminary report promptly (c. 3–5 days), full report within 30 days (60 if malicious)
    DPO
    No
    Cross-border transfers
    Consent with country information, or whitelisted country (EU/UK), or equivalent-system recipient (e.g. APEC CBPR)
    Maximum penalty
    Entities up to JPY 100m for violating PPC orders or unlawful database provision (pre-2026)
    Key dates
    • Adopted
    • In force
    • Major amendments in force 2017-05-30, 2022-04-01 (2020/2021 amendments), 2023-04-01 (local government); 2026 amendment (Act No. 56 of 2026) promulgated 2026-07-17 – see jp-appi-amendment-2026
    Text
    Authority
    Personal Information Protection Commission (PPC)
    Sources consulted
    Verification

    High confidence.

    Breach report day-counts from PPC rules (general knowledge). Mutual EU adequacy since 2019-01-23.

    Full record for APPI
  • APPI Amendment 2026Act Partially Amending the Act on the Protection of Personal Information (Act No. 56 of 2026)Enacted – not yet in force
    In force from     Output of the PPC triennial review: adds an administrative surcharge system, rules for children under 16, new biometric data rules and stronger PPC powers. It also creates a consent exception for third-party provision solely for statistics creation (including AI training) and lets low-risk breaches skip individual notice.
    Synopsis

    Output of the PPC triennial review: adds an administrative surcharge system, rules for children under 16, new biometric data rules and stronger PPC powers. It also creates a consent exception for third-party provision solely for statistics creation (including AI training) and lets low-risk breaches skip individual notice.

    Key themes
    • administrative surcharges
    • children under 16
    • biometrics
    • AI training / statistics exception
    • breach notice relief
    • criminal penalties
    Unique features

    Surcharge pegged to consideration received from violations affecting over 1,000 people; best-interests-of-the-child duty.

    SaaS relevance

    SaaS selling data-driven services in Japan face surcharges once commenced and new duties if users include under-16s; AI training data sharing gets a legal pathway.

    Extraterritorial
    Yes
    Maximum penalty
    Surcharge calculated from consideration received (method set by Cabinet Order); higher corporate criminal fines
    Key dates
    • Adopted
    • In force
    • Cabinet bill 2026-04-07; passed Diet 2026-07-10; promulgated 2026-07-17; criminal provisions 2027-01-17; main reforms by Cabinet Order no later than 2028-07-17
    Text
    Authority
    Personal Information Protection Commission (PPC)
    Sources consulted
    Verification

    High confidence.

    date_in_force shows first phase only (criminal provisions). [Link: official Japanese amending Act text on PPC (landing: ppc.go.jp/personalinfo/legal/r8kaiseihogohou/); no English yet]

    Full record for APPI Amendment 2026

Sectoral privacy1

  • My Number ActAct on the Use of Numbers to Identify a Specific Individual in Administrative Procedures (Act No. 27 of 2013)In force
    In force from     Governs Japan's 12-digit Individual Number (My Number) used for tax, social security and disaster response. It strictly limits who may collect, use and keep My Numbers and imposes tighter rules than the APPI, supervised by the PPC.
    Synopsis

    Governs Japan's 12-digit Individual Number (My Number) used for tax, social security and disaster response. It strictly limits who may collect, use and keep My Numbers and imposes tighter rules than the APPI, supervised by the PPC.

    Key themes
    • national identifier
    • specific personal information
    • restricted use
    • security measures
    • PPC supervision
    Unique features

    Use and collection allowed only for statutory purposes; heavier criminal penalties than APPI.

    SaaS relevance

    HR, payroll and accounting SaaS in Japan handling employee My Numbers must meet its strict safeguards.

    Breach notification
    Report serious incidents to PPC
    Key dates
    • Adopted
    • In force
    • Number notification from Oct 2015; use began 2016-01-01; multiple amendments since
    Text
    Authority
    Personal Information Protection Commission (PPC)
    Sources consulted
    Verification

    Medium confidence.

    Partly verifiedMedium confidence. Act number and dates from general knowledge; sources read did not detail the Act.

    Full record for My Number Act
    Partly verifiedMedium confidence. Act number and dates from general knowledge; sources read did not detail the Act.

ePrivacy / marketing2

  • TBA External Transmission RuleTelecommunications Business Act – External Transmission of User Information Rule (Art. 27-12, 2022 amendment)In force
    In force from     Requires covered online service providers that cause users' devices to send user information to third parties (e.g. via tags, SDKs or third-party cookies) to give notice or publish details, obtain consent, or offer an opt-out. Japan's cookie-style rule.
    Synopsis

    Requires covered online service providers that cause users' devices to send user information to third parties (e.g. via tags, SDKs or third-party cookies) to give notice or publish details, obtain consent, or offer an opt-out. Japan's cookie-style rule.

    Key themes
    • cookies
    • tags and SDKs
    • notice/publication
    • consent
    • opt-out
    • foreign operators
    Unique features

    Notice-or-publication satisfies the rule (no default consent requirement), unlike EU cookie consent.

    SaaS relevance

    SaaS with websites or apps serving Japanese users that embed third-party analytics or ad tags must publish transmission details.

    Extraterritorial
    Yes
    Maximum penalty
    Business improvement orders
    Key dates
    • Adopted
    • In force
    Text
    Authority
    Ministry of Internal Affairs and Communications (MIC)
    Sources consulted
    Verification

    High confidence.

    [Link: official Japanese (e-Gov, TBA Act No. 86 of 1984, Art. 27-12); no verified current English translation]

    Full record for TBA External Transmission Rule
  • Anti-Spam ActAct on Regulation of Transmission of Specified Electronic Mail (Act No. 26 of 2002)In force
    In force from     Requires opt-in consent for advertising emails and SMS, sender identification and an opt-out mechanism, with record-keeping of consent.
    Synopsis

    Requires opt-in consent for advertising emails and SMS, sender identification and an opt-out mechanism, with record-keeping of consent.

    Key themes
    • opt-in
    • sender identification
    • opt-out
    • consent records
    Unique features

    Consent records must be retained.

    SaaS relevance

    Applies to SaaS sending marketing emails to Japanese recipients.

    Maximum penalty
    Corporate fines up to JPY 30m
    Key dates
    • Adopted
    • In force
    Text
    Authority
    Ministry of Internal Affairs and Communications / Consumer Affairs Agency
    Sources consulted
    Verification

    Medium confidence.

    Partly verifiedMedium confidence. Act number/dates from general knowledge. [Link: official Japanese (e-Gov); MOJ Japanese Law Translation (may lag amendments)]

    Full record for Anti-Spam Act
    Partly verifiedMedium confidence. Act number/dates from general knowledge. [Link: official Japanese (e-Gov); MOJ Japanese Law Translation (may lag amendments)]

AI / automated decisions1

  • AI Promotion ActAct on Promotion of Research and Development and Utilization of Artificial Intelligence-Related TechnologiesIn force
    In force from     Framework law promoting AI research and use, creating a Cabinet-level AI Strategy Headquarters and requiring a national AI Basic Plan. Businesses are asked to cooperate with government measures, with no penalties.
    Synopsis

    Framework law promoting AI research and use, creating a Cabinet-level AI Strategy Headquarters and requiring a national AI Basic Plan. Businesses are asked to cooperate with government measures, with no penalties.

    Key themes
    • AI promotion
    • AI Basic Plan
    • AI Strategy Headquarters
    • soft-law cooperation
    • investigation of harmful uses
    Unique features

    Soft-law, non-binding approach; government may investigate and publicise misuse cases but cannot fine.

    SaaS relevance

    No direct obligations, but AI SaaS in Japan should track guidelines issued under the Basic Plan.

    Maximum penalty
    None
    Key dates
    • Adopted
    • In force
    • Promulgated and largely effective 2025-06-04; Chapters 3–4 (AI Basic Plan, AI Strategy Headquarters) effective Sept 2025
    Text
    Authority
    AI Strategy Headquarters (Cabinet)
    Sources consulted
    Verification

    Medium confidence.

    Partly verifiedMedium confidence. Diet passage date (2025-05-28) from general knowledge. [Link: official Japanese (e-Gov); MOJ Japanese Law Translation]

    Full record for AI Promotion Act
    Partly verifiedMedium confidence. Diet passage date (2025-05-28) from general knowledge. [Link: official Japanese (e-Gov); MOJ Japanese Law Translation]
Part II

Regional & international frameworks

Membership-based — check ratification status in the instrument record. 12 instruments from 4 bodies.

Organisation for Economic Co-operation and Development (OECD)

  • OECD AI PrinciplesRecommendation of the Council on Artificial Intelligence (OECD AI Principles)In force
    In force from     Five values-based principles for trustworthy AI: inclusive growth and wellbeing; human rights and democratic values including privacy and fairness; transparency and explainability; robustness, security and safety; and accountability. These are paired with five recommendations to governments. The definition of an 'AI system' it contains was adopted in the EU AI Act.
    Synopsis

    Five values-based principles for trustworthy AI: inclusive growth and wellbeing; human rights and democratic values including privacy and fairness; transparency and explainability; robustness, security and safety; and accountability. These are paired with five recommendations to governments. The definition of an 'AI system' it contains was adopted in the EU AI Act.

    Key themes
    • trustworthy AI
    • human rights
    • privacy
    • transparency
    • explainability
    • robustness
    • accountability
    Unique features

    It was the first intergovernmental AI standard. Its AI-system definition was taken up in the EU AI Act and the CoE AI Convention.

    SaaS relevance

    Soft-law benchmark for AI governance in SaaS products, and the source of definitions used in binding laws.

    Breach notification
    None
    DPO
    No
    Cross-border transfers
    None
    Maximum penalty
    None
    Key dates
    • Adopted
    • In force
    • OECD/LEGAL/0449; adopted 2019-05-22; updated 2024-05-03 (generative AI, the definition of an AI system, safety, information integrity); G20 AI Principles (2019) draw on it
    Text
    Authority
    OECD Working Party on AI Governance / OECD.AI
    Sources consulted
    Verification

    High confidence.

    Full record for OECD AI Principles
  • OECD Trusted Government Access DeclarationDeclaration on Government Access to Personal Data Held by Private Sector EntitiesIn force
    In force from     The first intergovernmental statement of shared principles for government access to personal data held by private companies for law enforcement and national security. It covers seven principles: legal basis, legitimate aims, approvals, data handling, transparency, oversight and redress.
    Synopsis

    The first intergovernmental statement of shared principles for government access to personal data held by private companies for law enforcement and national security. It covers seven principles: legal basis, legitimate aims, approvals, data handling, transparency, oversight and redress.

    Key themes
    • government access
    • national security
    • law enforcement
    • legal basis
    • oversight
    • redress
    • transparency
    Unique features

    It codifies democratic safeguards on compelled access. It was cited in the context of the EU–US Data Privacy Framework and in transfer impact assessments.

    SaaS relevance

    Useful reference for transfer impact assessments and for policies on responding to government data demands.

    Breach notification
    None
    DPO
    No
    Cross-border transfers
    Supports trusted data flows between adherents
    Maximum penalty
    None
    Key dates
    • Adopted
    • In force
    • OECD/LEGAL/0487; adopted at the Digital Economy Ministerial meeting on 2022-12-14; the EU also adhered
    Text
    Authority
    None designated
    Sources consulted
    Verification

    High confidence.

    Full record for OECD Trusted Government Access Declaration
  • OECD Privacy Guidelines 2013Recommendation of the Council concerning Guidelines Governing the Protection of Privacy and Transborder Flows of Personal Data (revised 2013)In force
    In force from     Keeps the eight 1980 principles and adds new implementation ideas: privacy management programmes, breach notification to authorities and individuals, national privacy strategies, privacy enforcement authorities with adequate powers, and interoperability between privacy frameworks.
    Synopsis

    Keeps the eight 1980 principles and adds new implementation ideas: privacy management programmes, breach notification to authorities and individuals, national privacy strategies, privacy enforcement authorities with adequate powers, and interoperability between privacy frameworks.

    Key themes
    • accountability
    • privacy management programmes
    • breach notification
    • enforcement cooperation
    • interoperability
    • transborder flows
    Unique features

    It made the controller's accountability programme concrete and introduced breach notification into an intergovernmental instrument. It favours a risk-based approach to transborder restrictions.

    SaaS relevance

    It informs accountability-programme expectations in many OECD countries' laws that apply to SaaS providers.

    Breach notification
    Recommended: authority and affected individuals for significant breaches
    DPO
    No
    Cross-border transfers
    Restrictions should be proportionate to risk
    Maximum penalty
    None
    Key dates
    • Adopted
    • In force
    • OECD/LEGAL/0188; first adopted 1980-09-23; revised 2013-07-11; implementation reviews continue
    Text
    Authority
    OECD Working Party on Data Governance and Privacy
    Sources consulted
    Verification

    High confidence.

    Full record for OECD Privacy Guidelines 2013
  • OECD Guidelines 1980OECD Guidelines on the Protection of Privacy and Transborder Flows of Personal Data (1980)Repealed/superseded
    In force from     A non-binding OECD Council Recommendation that set out eight basic principles: collection limitation, data quality, purpose specification, use limitation, security safeguards, openness, individual participation and accountability. It also encouraged free transborder flows between member countries.
    Synopsis

    A non-binding OECD Council Recommendation that set out eight basic principles: collection limitation, data quality, purpose specification, use limitation, security safeguards, openness, individual participation and accountability. It also encouraged free transborder flows between member countries.

    Key themes
    • eight fair information principles
    • accountability
    • transborder flows
    Unique features

    These eight principles became the global baseline that APEC, Canadian PIPEDA, Australian law and many others draw on. It was adopted at about the same time as Convention 108.

    SaaS relevance

    Historical baseline; its principles are reflected in most national laws a SaaS provider meets.

    Breach notification
    None
    DPO
    No
    Cross-border transfers
    Free flow encouraged; restrictions only where proportionate
    Maximum penalty
    None
    Key dates
    • Adopted
    • In force
    • Revised 2013-07-11 (see separate row)
    Text
    Authority
    None designated
    Sources consulted
    Verification

    High confidence.

    The 1980 text was replaced by the 2013 revision of the same instrument (OECD/LEGAL/0188).

    Full record for OECD Guidelines 1980

Global Cross-Border Privacy Rules Forum

  • Global CBPR / Global PRPGlobal Cross-Border Privacy Rules (Global CBPR) and Global Privacy Recognition for Processors (Global PRP) SystemsIn force
    In force from     An international certification system that takes the APEC CBPR and PRP model outside APEC, open to any jurisdiction that joins the Forum. Companies are certified by Forum-recognised Accountability Agents against Global CBPR (controller) or Global PRP (processor) requirements.
    Synopsis

    An international certification system that takes the APEC CBPR and PRP model outside APEC, open to any jurisdiction that joins the Forum. Companies are certified by Forum-recognised Accountability Agents against Global CBPR (controller) or Global PRP (processor) requirements.

    Key themes
    • certification
    • interoperability
    • accountability agents
    • processors
    • data flows
    Unique features

    The Forum is independent of APEC. Its systems started out the same as APEC's but are expected to diverge over time, and it admits non-APEC Associates such as the UK, Bermuda, DIFC and Mauritius.

    SaaS relevance

    A SaaS provider acting as processor can get Global PRP certification to show baseline controls to customers in member jurisdictions.

    Breach notification
    None
    DPO
    No
    Cross-border transfers
    Certification-based transfer mechanism
    Maximum penalty
    Decertification; enforcement under local law
    Key dates
    • Adopted
    • In force
    • Global CBPR Forum declaration April 2022; the Global CBPR and Global PRP certifications launched in 2025 (Forum news items dated 2025-05-28 and 2025-06-09 announce launch and 'now live')
    Text
    Authority
    Global CBPR Forum; Accountability Agents
    Sources consulted
    Verification

    Medium confidence.

    Partly verifiedMedium confidence. The exact go-live day in 2025 is unclear (late May or early June 2025). The founding members are understood to be the US, Canada, Japan, Korea, Singapore, the Philippines and Chinese Taipei, but I did not open the membership page.

    Full record for Global CBPR / Global PRP
    Partly verifiedMedium confidence. The exact go-live day in 2025 is unclear (late May or early June 2025). The founding members are understood to be the US, Canada, Japan, Korea, Singapore, the Philippines and Chinese Taipei, but I did not open the membership page.

Asia-Pacific Economic Cooperation (APEC)

  • APEC CBPR / PRPAPEC Cross-Border Privacy Rules (CBPR) System and Privacy Recognition for Processors (PRP) SystemIn force
    In force from     Voluntary, enforceable certification schemes. CBPR certifies that a controller's privacy policies meet the APEC Privacy Framework, and PRP certifies a processor's ability to help controllers comply. Recognised Accountability Agents assess companies, and local privacy enforcement authorities back up enforcement.
    Synopsis

    Voluntary, enforceable certification schemes. CBPR certifies that a controller's privacy policies meet the APEC Privacy Framework, and PRP certifies a processor's ability to help controllers comply. Recognised Accountability Agents assess companies, and local privacy enforcement authorities back up enforcement.

    Key themes
    • certification
    • accountability agents
    • cross-border enforcement
    • processors
    Unique features

    It is one of the few certification-based transfer tools recognised by several national laws (e.g. Japan, Singapore).

    SaaS relevance

    PRP is designed for SaaS and other processors, and CBPR or PRP certification can support transfers and customer due diligence in participating economies.

    Breach notification
    None
    DPO
    No
    Cross-border transfers
    Certification-based transfer mechanism
    Maximum penalty
    Decertification; enforcement under local law
    Key dates
    • Adopted
    • In force
    • CBPR endorsed by APEC Leaders in 2011, first certifications 2013; PRP launched 2015. Since 2022–25 the systems have been mirrored by the separately administered Global CBPR and Global PRP (see separate row).
    Text
    Authority
    Participating economies' privacy enforcement authorities; APEC-recognised Accountability Agents
    Sources consulted
    Verification

    Medium confidence.

    Partly verifiedMedium confidence. The years are from established references. I did not check whether APEC is winding down its own system in favour of the Global systems.

    Full record for APEC CBPR / PRP
    Partly verifiedMedium confidence. The years are from established references. I did not check whether APEC is winding down its own system in favour of the Global systems.
  • APEC Privacy FrameworkAPEC Privacy FrameworkIn force
    In force from     A non-binding set of nine information privacy principles for the 21 APEC economies, adapted from the OECD Guidelines: preventing harm, notice, collection limitation, uses, choice, integrity, security safeguards, access and correction, and accountability. It aims to protect privacy while keeping information flowing across the region.
    Synopsis

    A non-binding set of nine information privacy principles for the 21 APEC economies, adapted from the OECD Guidelines: preventing harm, notice, collection limitation, uses, choice, integrity, security safeguards, access and correction, and accountability. It aims to protect privacy while keeping information flowing across the region.

    Key themes
    • preventing harm
    • notice
    • choice
    • accountability
    • cross-border privacy enforcement
    • interoperability
    Unique features

    Its harm-based, accountability-led model contrasts with the rights-based European approach. It is the basis of the CBPR and PRP certification systems.

    SaaS relevance

    It underpins CBPR and PRP certifications, which SaaS providers can use to show compliance and support transfers in participating economies.

    Breach notification
    None
    DPO
    No
    Cross-border transfers
    Accountability-based; CBPR system
    Maximum penalty
    None
    Key dates
    • Adopted
    • In force
    • Endorsed by APEC Ministers in 2004 and published in 2005; updated in 2015 (endorsed 2016)
    Text
    Authority
    APEC Digital Economy Steering Group (DESG) Data Privacy Subgroup
    Sources consulted
    Verification

    Medium confidence.

    Partly verifiedMedium confidence. I did not re-check the publication URL this session.

    Full record for APEC Privacy Framework
    Partly verifiedMedium confidence. I did not re-check the publication URL this session.

United Nations

  • UN Cybercrime ConventionUnited Nations Convention against Cybercrime; Strengthening International Cooperation for Combating Certain Crimes Committed by Means of Information and Communications Technology Systems and for the Sharing of Evidence in Electronic Form of Serious CrimesSigned – not ratified
    The first global UN treaty on cybercrime. It requires states to criminalise a set of computer-related offences and to provide procedural powers, such as preserving and producing stored data and collecting traffic and content data, and it sets up channels for cross-border e-evidence cooperation on serious crimes. It includes a general human rights clause and conditions and safeguards on these powers.
    Synopsis

    The first global UN treaty on cybercrime. It requires states to criminalise a set of computer-related offences and to provide procedural powers, such as preserving and producing stored data and collecting traffic and content data, and it sets up channels for cross-border e-evidence cooperation on serious crimes. It includes a general human rights clause and conditions and safeguards on these powers.

    Key themes
    • cybercrime offences
    • e-evidence
    • production orders
    • data preservation
    • mutual legal assistance
    • human rights safeguards
    Unique features

    It is broader than the Budapest Convention in that evidence sharing covers any 'serious crime'. Rights groups and industry have criticised its safeguards as weak.

    SaaS relevance

    Once in force and implemented, it could widen the range of states able to issue preservation and production orders to cloud and SaaS providers.

    Extraterritorial
    Limited
    Breach notification
    None
    DPO
    No
    Cross-border transfers
    Cooperation channels for electronic evidence
    Maximum penalty
    Set by national law
    Key dates
    • Adopted
    • Adopted by the UN General Assembly in December 2024; opened for signature in Hanoi on 2025-10-25; enters into force 90 days after the 40th ratification. About 3 ratifications (Qatar, Azerbaijan, Viet Nam) as of mid-2026.
    Text
    Authority
    UNODC (secretariat); Conference of the States Parties once in force
    Sources consulted
    Verification

    Medium confidence.

    Partly verifiedMedium confidence. The ratification count comes from secondary sources as of mid-2026. The convention is not in force (it needs 40 ratifications). The exact GA adoption date (24 Dec 2024, A/RES/79/243) comes from established references and I did not re-verify it.

    Full record for UN Cybercrime Convention
    Partly verifiedMedium confidence. The ratification count comes from secondary sources as of mid-2026. The convention is not in force (it needs 40 ratifications). The exact GA adoption date (24 Dec 2024, A/RES/79/243) comes from established references and I did not re-verify it.
  • Right to privacy in the digital ageUN General Assembly resolutions on the right to privacy in the digital age (series)In force
    In force from     This is a recurring series of non-binding General Assembly resolutions. They confirm that people have the same privacy rights online as offline, and they ask states to review surveillance, interception and bulk data collection against international human rights law. Later resolutions also cover AI, biometrics, encryption and data brokers.
    Synopsis

    This is a recurring series of non-binding General Assembly resolutions. They confirm that people have the same privacy rights online as offline, and they ask states to review surveillance, interception and bulk data collection against international human rights law. Later resolutions also cover AI, biometrics, encryption and data brokers.

    Key themes
    • surveillance
    • interception
    • AI and privacy
    • encryption
    • business responsibility
    • remedies
    Unique features

    The series grew out of the 2013 Snowden revelations. It led to OHCHR reports and, through the Human Rights Council, to the Special Rapporteur on privacy.

    SaaS relevance

    These are soft-law expectations on business respect for privacy (UN Guiding Principles), which are relevant to transparency reporting and to how a provider handles government data requests.

    Breach notification
    None
    DPO
    No
    Cross-border transfers
    None
    Maximum penalty
    None
    Key dates
    • Adopted
    • In force
    • First resolution A/RES/68/167 (2013-12-18); renewed roughly every two years; latest verified A/RES/79/175 adopted 2024-12-17
    Text
    Authority
    Office of the UN High Commissioner for Human Rights (OHCHR) reports; UN Special Rapporteur on the right to privacy
    Sources consulted
    Verification

    Medium confidence.

    Partly verifiedMedium confidence. Treated as one row for the whole series. I did not check whether a newer resolution was adopted at the 80th session in late 2025.

    Full record for Right to privacy in the digital age
    Partly verifiedMedium confidence. Treated as one row for the whole series. I did not check whether a newer resolution was adopted at the 80th session in late 2025.
  • ICCPR Art 17International Covenant on Civil and Political Rights, Article 17In force
    In force from     This is a binding treaty. Article 17 bans arbitrary or unlawful interference with privacy, family, home or correspondence, and requires states parties to protect people from such interference by law. The Human Rights Committee monitors compliance through state reports and, for states that accept it, individual complaints.
    Synopsis

    This is a binding treaty. Article 17 bans arbitrary or unlawful interference with privacy, family, home or correspondence, and requires states parties to protect people from such interference by law. The Human Rights Committee monitors compliance through state reports and, for states that accept it, individual complaints.

    Key themes
    • right to privacy
    • state obligations
    • legality
    • arbitrariness
    • individual communications
    Unique features

    It is the main binding global privacy guarantee and has about 170+ parties. General Comment 16 reads it as covering the gathering and holding of personal information, including by private bodies.

    SaaS relevance

    It binds states, not companies, but it shapes national privacy laws and the rules on government access to the data SaaS providers hold.

    Breach notification
    None
    DPO
    No
    Cross-border transfers
    None
    Maximum penalty
    None (treaty-body views; no fines)
    Key dates
    • Adopted
    • In force
    • Adopted by GA resolution 2200A (XXI) on 1966-12-16; in force 1976-03-23. Human Rights Committee General Comment No. 16 on Article 17 was issued in 1988.
    Text
    Authority
    UN Human Rights Committee (treaty body)
    Sources consulted
    Verification

    High confidence.

    The party count is approximate and was not re-checked against the UN Treaty Collection.

    Full record for ICCPR Art 17
  • UDHR Art 12Universal Declaration of Human Rights, Article 12In force
    In force from     Article 12 says no one may be subjected to arbitrary interference with their privacy, family, home or correspondence, and that everyone is entitled to legal protection against such interference. It is a declaration rather than a treaty, but it is the starting point for privacy as an international human right.
    Synopsis

    Article 12 says no one may be subjected to arbitrary interference with their privacy, family, home or correspondence, and that everyone is entitled to legal protection against such interference. It is a declaration rather than a treaty, but it is the starting point for privacy as an international human right.

    Key themes
    • right to privacy
    • correspondence
    • reputation
    • protection of the law
    Unique features

    Not legally binding in itself, though many of its provisions are treated as customary international law. Every later privacy instrument, from the ECHR to the ICCPR, builds on this text.

    SaaS relevance

    Gives no direct obligations to a SaaS business; it is useful as the human rights background for policies and DPIAs.

    Breach notification
    None
    DPO
    No
    Cross-border transfers
    None
    Maximum penalty
    None
    Key dates
    • Adopted
    • In force
    • Proclaimed by the UN General Assembly in Paris on 10 December 1948
    Text
    Authority
    None designated
    Sources consulted
    Verification

    High confidence.

    The CIPP/E project holds a copy (1948UDHR.pdf).

    Full record for UDHR Art 12
  • UN Guidelines 1990Guidelines for the Regulation of Computerized Personal Data FilesIn force
    In force from     Non-binding guidelines from the General Assembly that set minimum guarantees for national laws on computerised personal data files, covering both public and private files. They list principles such as lawfulness and fairness, accuracy, purpose specification, interested-person access, non-discrimination, security and independent supervision.
    Synopsis

    Non-binding guidelines from the General Assembly that set minimum guarantees for national laws on computerised personal data files, covering both public and private files. They list principles such as lawfulness and fairness, accuracy, purpose specification, interested-person access, non-discrimination, security and independent supervision.

    Key themes
    • fair information principles
    • sensitive data
    • access
    • security
    • supervisory authority
    • transborder flows
    Unique features

    Separate provisions extend the principles to files held by international governmental organisations. They also have an early non-discrimination rule on sensitive data and allow transfers to countries with comparable safeguards.

    SaaS relevance

    Gives no direct obligations; it is historical background to UN-system data protection policies.

    Breach notification
    None
    DPO
    No
    Cross-border transfers
    Free flow to states with comparable safeguards
    Maximum penalty
    None
    Key dates
    • Adopted
    • In force
    Text
    Authority
    None designated
    Sources consulted
    Verification

    Medium confidence.

    Partly verifiedMedium confidence. I did not open the resolution text in this session. The resolution number and date come from established references. Refworld is a UNHCR mirror; the official text is in the UN Digital Library under A/RES/45/95.

    Full record for UN Guidelines 1990
    Partly verifiedMedium confidence. I did not open the resolution text in this session. The resolution number and date come from established references. Refworld is a UNHCR mirror; the official text is in the UN Digital Library under A/RES/45/95.